MastoMailBlocker

When you register your instance, all previously known domains are sent to your instance via REST API. Since there are over 3000 domains, it may take some time until all of them are registered with you. Mastodon has an API limit of 300 requests per 5 minutes. We then check for new domains once a week and send them to all registered entities. You don't have to worry about anything else.

Go to /admin/settings/registrations and set "Approval required for sign up". This means that new accounts are not activated automatically; an admin or moderator has to do this manually.

MastoMailBlocker uses the domains from a Github repository that is regularly expanded.

One way to protect your Mastodon instance against spam bots is to prevent new registrations by excluding certain disposable email domains that they often use. You can either set it up yourself at /admin/email_domain_blocks or use this service. Of course, this doesn't provide absolute protection, but it does limit the options somewhat.